22 Oct 1999 - Cracking Merlyn 2.1 by Miscreant
Rating: Easy

Program Details
Program Name: Merlyn 2.1 - By Hyland Software
Program Type: Mathematics Equations Utility
Program Location: http://www.hylandsoftware.com/
Program Size: 3.35mb

Tools used
SoftIce 3.25 (use 4 if you like)
W32Dasm 8.93
A Hex Editor (I used HIEW/UltraEdit)

From the Merlyn help file -
We created Merlyn to do two things. First, we wanted to be able to create mathematical expressions.
We wanted it to be fast and flexible; and we wanted the equations to look just like they do in a textbook.
Second, we wanted to be able to manipulate those equations. What do we mean by manipulating equations?
If you look at any problem that's been done in detail, step by step, in a textbook, the difference between one step
and the next is that some part of the expression has been rearranged, simplified, canceled, etc.
This is just what Merlyn does. You select the part of the expression you want to change, then you tell Merlyn what kind of
change you want. You apply commands like simplify, cancel, commute, and so on, and the expression changes accordingly.
If there is more than one possibility you're offered a list of options. Pick the one you want and the result will appear in your document.

We designed Merlyn for everyday calculations. Our goal was to create software that would be just as fast and flexible, and a whole
lot less error prone, than that paper and pencil method you currently use. We also designed Merlyn with students in mind. Merlyn not
only gets you to the answer, but it takes you through the steps to help you understand whatÆs happening along the way.

IMPORTANT NOTE: If you download the trial from the Hyland website, install it and find that it says Merlyn 2.0 on the Start Menu,
do not worry - they didn't update the setup program - check the About Box for the true version.

About This Protection System:
Registration is not possible, after 30 days you must buy the program.
The program is not compacted/encrypted in any way.

No nag screens, except when trial is over. Title bar of main application displays days remaining, about box displays Trial Version.

The Essay:
OK, first thing I did was to set my date forward (at least 30 days) and run the program, then note down important strings. I noticed:

Merlyn - this trial version has expired
^-- this appears in the title bar of both the main window and the nag screen.

Then I opened up W32Dasm, disassembled it, chose string references and looked for this string...
I found:
Merlyn - this trial version has

The word 'expired' has lost itself somewhere, but if you double click on the string you will find it underneath.
Here is what I found:

:004BB897 A150DE4B00 mov eax, dword ptr [004BDE50]
:004BB89C 8B00 mov eax, dword ptr [eax]
:004BB89E E8A988FAFF call 0046414C
:004BB8A3 85C0 test eax, eax
:004BB8A5 7D21 jge 004BB8C8

* Possible StringData Ref from Code Obj ->"Merlyn - this trial version has "
:004BB8A7 BAE4B94B00 mov edx, 004BB9E4
:004BB8AC 8BC3 mov eax, ebx

How convenient :) A crackers gate :)
So whats a crackers gate? A nice little test and then a compare routine.

So whats it mean?
LINE 1:004BB89E E8A988FAFF call 0046414C <-- Check amount of days remaining
LINE 2:004BB8A3 85C0 test eax, eax <-- Look at results
LINE 3:004BB8A5 7D21 jge 004BB8C8 <-- If its more than or equal to something then jump to 4BB8C8

I labelled the 3 lines 1,2 and 3 to make it easier for me to talk about them.
Now load up Symbol Loader (the proggie that comes with softice), choose file, open then choose merlyn.exe
Once it has loaded click on Module, Load and it will ask if you are sure, choose yes and softice should pop up.
WHAT TO DO IF IT DOESN'T POP UP: Choose Module, Settings and make sure that Load Executable and Stop at Winmain... are both checked!
SoftIce pops up at the start of the program.
Type: bpx 4BB8A5
This sets a breakpoint on that line.
Now type: X [ENTER]
Softice should flash off then on, this is because it broke in where we set the breakpoint!
We can see that softice doesn't want to jump, so we therefore do want it to jump.
Type: A
Once you hit enter you will be able to modify that line of code. So type: JMP 4bb8c8
Hit enter twice to finish editing.

Notice the 7D21 changes to EB21.
Now type BC * [ENTER]
This clears all breakpoints.
Type: X [ENTER]

Softice will now exit and the program will load with no problems - how convenient :)

Now we need to hex edit the code.
So load up your favourite hex editor (I recommend Hackers View or UltraEdit) - some people prefer hex workshop - which I personally hate.

Search for 85C07D21 - Where did I get this number from?

LINE 2:004BB8A3 85C0
LINE 3:004BB8A5 7D21

You can see the numbers were at the end of the above two lines.

Now change the 7D21 to EB21, run the program and voila - it works forever :)

Now we have one last problem. The title bar says the amount of days still.
So note down the string in the titlebar:
Merlyn - this trial version expires in xx days

Load up W32Dasm again, and look for the string. Heres what I found:
:004BB828 C7803402000048AB4B00 mov dword ptr [ebx+00000234], 004BAB48
:004BB832 80BB4503000000 cmp byte ptr [ebx+00000345], 00
:004BB839 0F84E3000000 je 004BB922

* Possible StringData Ref from Code Obj ->"Merlyn - this trial version expires "
->"in "
:004BB83F 68A4B94B00 push 004BB9A4

hmmm, the jump looks very interesting :) Lets change it to JMP instead of JE, so it always jumps.
JE = Jump if equal (Conditional)
JMP = Always Jump (Unconditional)

Wahoo! It worked, now just the finishing touches.
Open up a hex editor and search for the strings in the about box, and change them to Full Version etc.
(You could also use a resource editor if you wish).


If you managed to crack the proggie, go and have a well deserved cuppa.

The Crack
I'm not making it that easy - read the essay you lazy person :)

Final Notes
Well this is my first essay, I hope it helps someone out there. You can find me on EFNet under the nickname Miscreant - mostly at weekends.
Feel free to send me constructive critisism or nice comments. I made this essay because I saw way to many essays on serial number cracking,
but not enough on programs that don't allow serial #'s to be entered. If I get enough feedback I may write some more essays.

I would like to thank in no particular order:
#Cracking4Newbies - For their kind patience
BubbleGun - Who brought me into the scene
WAKKeHACK - For recording futurama for me - hehehe
The Sandman - For his great essays
Fravia - For having perhaps the largest, yet messiest website on the entire web
Numega - For the greatest debugger ever
Slide - For trying this essay for me and telling me what didn't work - all fixed now ;)
Duelist - For helping me so much on hard cracks
MisterE - ditto.
And anyone else I forgot.

If you like and use this program then please buy it. The authors deserve the money. If you don't like spending money, get Linux.
Essay written on 22-Oct-1999.

This essay is best printed using Verdana font on size 8.

I would like to thank
Slide for pointing out my mistakes - well complaining when the tutorial didn't work. Should have ironed out all the bugs ;)
#cracking4newbies for all their help